diff options
author | Ilya Leoshkevich <iii@linux.ibm.com> | 2021-02-12 07:04:08 +0300 |
---|---|---|
committer | Daniel Borkmann <daniel@iogearbox.net> | 2021-02-16 01:39:35 +0300 |
commit | 45159b27637b0fef6d5ddb86fc7c46b13c77960f (patch) | |
tree | 550e6c296b1553208bc69dedb62f60995e000daf /block/bfq-iosched.c | |
parent | 5e1d40b75ed85ecd76347273da17e5da195c3e96 (diff) | |
download | linux-45159b27637b0fef6d5ddb86fc7c46b13c77960f.tar.xz |
bpf: Clear subreg_def for global function return values
test_global_func4 fails on s390 as reported by Yauheni in [1].
The immediate problem is that the zext code includes the instruction,
whose result needs to be zero-extended, into the zero-extension
patchlet, and if this instruction happens to be a branch, then its
delta is not adjusted. As a result, the verifier rejects the program
later.
However, according to [2], as far as the verifier's algorithm is
concerned and as specified by the insn_no_def() function, branching
insns do not define anything. This includes call insns, even though
one might argue that they define %r0.
This means that the real problem is that zero extension kicks in at
all. This happens because clear_caller_saved_regs() sets BPF_REG_0's
subreg_def after global function calls. This can be fixed in many
ways; this patch mimics what helper function call handling already
does.
[1] https://lore.kernel.org/bpf/20200903140542.156624-1-yauheni.kaliuta@redhat.com/
[2] https://lore.kernel.org/bpf/CAADnVQ+2RPKcftZw8d+B1UwB35cpBhpF5u3OocNh90D9pETPwg@mail.gmail.com/
Fixes: 51c39bb1d5d1 ("bpf: Introduce function-by-function verification")
Reported-by: Yauheni Kaliuta <yauheni.kaliuta@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210212040408.90109-1-iii@linux.ibm.com
Diffstat (limited to 'block/bfq-iosched.c')
0 files changed, 0 insertions, 0 deletions